Radio-Frequency Identification (RFID): a Focus on Information Security and Privacy”, OECD Digital Economy Papers, No
Total Page:16
File Type:pdf, Size:1020Kb
Please cite this paper as: OECD (2008-01-14), “Radio-Frequency Identification (RFID): A Focus on Information Security and Privacy”, OECD Digital Economy Papers, No. 138, OECD Publishing, Paris. http://dx.doi.org/10.1787/230618820755 OECD Digital Economy Papers No. 138 Radio-Frequency Identification (RFID) A FOCUS ON INFORMATION SECURITY AND PRIVACY OECD Unclassified DSTI/ICCP/REG(2007)9/FINAL Organisation de Coopération et de Développement Economiques Organisation for Economic Co-operation and Development 14-Jan-2008 ___________________________________________________________________________________________ English - Or. English DIRECTORATE FOR SCIENCE, TECHNOLOGY AND INDUSTRY COMMITTEE FOR INFORMATION, COMPUTER AND COMMUNICATIONS POLICY Unclassified DSTI/ICCP/REG(2007)9/FINAL Working Party on Information Security and Privacy RADIO FREQUENCY IDENTIFICATION (RFID): A FOCUS ON INFORMATION SECURITY AND PRIVACY www.oecd.org/sti/security-privacy English - Or. English JT03238682 Document complet disponible sur OLIS dans son format d'origine Complete document available on OLIS in its original format DSTI/ICCP/REG(2007)9/FINAL FOREWORD This report was prepared by the Secretariat with the assistance of Nick Mansfield, consultant to the OECD. The first draft benefitted from initial input from Francis Aldhouse, consultant to the OECD. It includes comments and suggestions from OECD member countries, business and civil society. The report was discussed by the Working Party on Information Security and Privacy in October 2007 and declassified by the Committee for Information, Computer and Communications Policy on 17 December 2007. It is published under the responsibility of the Secretary-General of the OECD. © 2008 OECD/OCDE. 2 DSTI/ICCP/REG(2007)9/FINAL TABLE OF CONTENTS EXECUTIVE SUMMARY ............................................................................................................................ 4 INTRODUCTION .......................................................................................................................................... 8 1. UNDERSTANDING RFID ...................................................................................................................... 10 1.1. A broad concept for a complex technology .............................................................................. 11 1.2. Hardware components .............................................................................................................. 12 1.3. Electromagnetic communication .............................................................................................. 16 1.4. Software and network components ........................................................................................... 23 2. INFORMATION SECURITY AND PRIVACY ...................................................................................... 25 2.1. Information security .................................................................................................................. 25 2.1.1. Typology of risks .................................................................................................................. 26 2.1.2. Security controls ................................................................................................................... 33 2.1.3. A holistic approach ............................................................................................................... 35 2.1.4. Adjusting security level to what is at stake ........................................................................... 36 2.2. Privacy ...................................................................................................................................... 37 2.2.1 Overview of privacy challenges ............................................................................................ 38 2.2.2 Possible safeguards ............................................................................................................... 41 CONCLUSION ............................................................................................................................................. 50 ANNEX I. EXAMPLES OF RFID STANDARDS ...................................................................................... 52 ANNEX II. NFC, UWB, ZIGBEE, RUBEE, WI-FI, ULTRASONIC TECHNOLOGIES ......................... 54 ANNEX III. SECURITY EXPLOITS .......................................................................................................... 57 ANNEX IV. THE ELECTRONIC PRODUCT CODE (EPC) NUMBER STRUCTURE ........................... 59 ANNEX V. EXAMPLES OF PRIVACY REFERENCES ........................................................................... 60 BIBLIOGRAPHY ......................................................................................................................................... 63 3 DSTI/ICCP/REG(2007)9/FINAL RADIO FREQUENCY IDENTIFICATION (RFID): A FOCUS ON INFORMATION SECURITY AND PRIVACY EXECUTIVE SUMMARY The deployment of Radio Frequency Identification (RFID) in a large number of application areas is promising. This paper introduces the main characteristics of RFID technologies and focuses on the information security and privacy aspects of RFID in the short term. It will be complemented by an overview of RFID applications and an analysis of economic aspects of RFID carried out by the OECD Working Party on the Information Economy (WPIE).1 Later on, and based on both sets of work, a common set of policy principles related to RFID will be developed.2 This report represents the first step of OECD work related to sensor-based environments. Follow-up work will address security and privacy issues raised by a number of possible longer-term trends such as the generalisation of object tagging (pervasive RFID), of open loop RFID and of other sensors and sensor networks that can monitor the environment. A varied and complex technology RFID is a convenient and popular term for a technology with vague boundaries and many facets. Radio-frequency identification is not always based on radio-frequency communications and identification is only one among the many functions RFID technology can perform. Rather, RFID enables data collection with contactless electronic tags and wireless transmitters (readers) for identification and other purposes. It can be seen as a first step towards sensor-based environments. Understanding the capabilities and limitations of RFID technology is essential because the likelihood of several potential security and privacy risks varies according to the type of RFID technology used as much as according to the context in which RFID is implemented. The paper therefore provides basic information on RFID technology, including elements regarding standards, hardware and software components, frequency ranges, modes of operation (electromagnetic induction or radio-waves) and operation ranges. Information security aspects There are a large number of potential risks to RFID tags, readers and tag-reader communication that implicate each of the three classical dimensions of security: availability, integrity and confidentiality. Examples include denial of service, jamming, cloning, eavesdropping and skimming. Malware using tags as a vector for dissemination has also been identified as a potential risk. Tags and readers are not the only components of RFID systems that require security protection. Software (middleware), network and database components are also subject to information security risks. RFID security risks are not theoretical: a number of vulnerable security products and systems, sometimes deployed at very large scale, have been 1 . See OECD (2007b, c). 2 . DSTI/ICCP/IE/REG(2007)1. 4 DSTI/ICCP/REG(2007)9/FINAL discovered by researchers or reported in the press. However, many of these potential risks are more or less likely to occur depending on the type of RFID technology used (e.g. eavesdropping is less likely when magnetic induction is used because the operation range is very short). Ensuring RFID security requires a mix of technical and non-technical controls to prevent and mitigate risk. A number of technical controls are available. However, their degree of sophistication, robustness, complexity and cost varies. As a result, there is no one-size-fits-all RFID security measure that would efficiently address a given class of risks in all possible situations and at low cost. The development of well tailored and innovative technical security safeguards for RFID may therefore be a critical success factor for large scale deployment of RFID in many areas. As mentioned above, not only do risks to RFID systems vary considerably according to the technology used, they also vary depending on the application contexts and scenarios. Consistent with the OECD Security Guidelines, risk assessment and risk management can help address the security of RFID systems. A holistic approach to risk (e.g. carefully considering each stage of the system’s life – planning, deployment, operation, data processing and end of life – and each component of the system – tags and readers, middleware, databases, back-end and network components) is required to develop an overall security strategy. The risk evaluation and management strategy help identify the necessity to strengthen specific parts of the system in order to compensate for some weaknesses that cannot be addressed directly. Like any technology, adjusting RFID security to the appropriate level requires striking the right balance between the value of the assets